CVE-2020-1960: 
Java vulnerability analysis and mitigation

A vulnerability was discovered in Apache Flink versions 1.1.0 to 1.10.0 (CVE-2020-1960). The issue affects systems running a process with an enabled JMXReporter where a port is configured via metrics.reporter.reporter_name>.port. The vulnerability was disclosed in May 2020 (CVE Mitre).

The vulnerability allows an attacker with local access to the machine and JMX port to execute a man-in-the-middle attack using a specially crafted request to rebind the JMXRMI registry to one under the attacker's control. The vulnerability has been assigned a CVSS:3.1 score indicating Medium severity with the following vector: AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:H (Apache List).

When successfully exploited, this vulnerability compromises any connection established to the process via JMX, allowing attackers to extract credentials and any other transferred data. This poses a significant risk to the confidentiality and integrity of the affected systems (CVE Mitre).

The vulnerability requires local access to the machine and access to the JMX port. The attack involves crafting a specific request to manipulate the JMXRMI registry binding (Red Hat Portal).

The vulnerability affects multiple versions of Apache Flink from 1.1.0 through 1.10.0. Users should upgrade to a patched version of the software to mitigate this security risk (CVE Mitre).